Brute Force Vulnerability in Argo CD Could Allow Attackers to Bypass Rate Limits and Target Default Admin Account

CVE-2024-21662

What is CVE-2024-21662?

Argo CD, a declarative GitOps continuous delivery tool for Kubernetes, presents a security vulnerability that allows malicious actors to bypass implemented rate limit and brute force protections. This exploit leverages a weak cache mechanism that tracks user login attempts but is constrained to a maximum cache size of 1000 entries. By overwhelming this cache with login attempts for different users, attackers can effectively purge the failed attempts of the default admin account, thereby resetting the rate limit and facilitating accelerated brute force attacks. This vulnerability builds upon an existing flaw associated with prior security measures designed to mitigate such attacks. Immediate upgrades to versions 2.8.13, 2.9.9, or 2.10.4 are recommended to rectify this security issue.

References